CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass (CWE-863, incorrect authorization): function-name validation is not applied to RangeFunction nodes appearing in SQL FROM clauses, so queries can invoke functions that restricted mode is supposed to block. An attacker who can submit SQL through the MCP server can trigger the flaw with FROM-clause syntax, for example invoking pg_read_file to read arbitrary files on the database server host. This yields high confidentiality impact (CVSS 4.0 score 9.2, critical), potentially exposing configuration files or credentials that could affect downstream systems, with no direct integrity or availability impact in the base score. Anyone running Postgres MCP Pro 0.3.0 in restricted mode with untrusted SQL input — a typical setup for AI-agent database access — is affected. There is no known exploitation: no public proof-of-concept, not listed in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days (30th percentile).

What to do: Upgrade any Postgres MCP Pro 0.3.0 deployment to a patched release (the fixed version is not specified in the available data) before exposing restricted mode to untrusted SQL sources. As an interim mitigation, revoke EXECUTE on sensitive file-reading functions such as pg_read_file (and membership in file-reading roles like pg_read_server_files) from the database role used by the MCP server, and review logs for FROM-clause function calls such as SELECT ... FROM pg_read_file(...).